Thank you Till.
It looks like suExec is my solution as all the scripts we would want to run are uploaded with FTP and owned by each site user and group.
Will it work simply by turning it "on" with the checkbox in ispConfig? I read somwehere that the webs would have to be in /var/www for suExec to work, but we already have live sites in /home/www. If so, can this be worked around by recompiling suExec to use /home/www instead of /var/www? What should be the USERDIR suffix, if any?
Would this affect later ispConfig updates or apg-get updates?
# /usr/sbin/suexec -V